How do I pipe splunk query output to a file?

[Alan_Bradley]

How do I take output (say . . . "View Sources") and pipe it to a file?

[mIliofotou_splu]

For Splunk 6.4.x:
Here is a list of different option for exporting to a file from the CLI

$SPLUNK_HOME/bin/splunk search 'index=main' -output table > tofile.txt
$SPLUNK_HOME/bin/splunk search 'index=main | head' -output raw > tofile.txt
$SPLUNK_HOME/bin/splunk search 'index=main | head' -output rawdata > tofile.txt
$SPLUNK_HOME/bin/splunk search '*' -output csv > tofile.txt
$SPLUNK_HOME/bin/splunk search 'index=main id=abs*' -output json > tofile.txt

The default behavior of the CLI search is to export first 100. Use the -maxout 0 option to bypass that limit.

$SPLUNK_HOME/bin/splunk search 'index=main id=abs*' -output json -maxout 0 > tofile.txt

If you don't specify an output option, the default is to only export _raw.

[matt · Accepted solution]

You have couple of options. The basic is simply using redirect to file, you can also use the -format flag.

./splunk search '*' -format csv > file-name

Valid types are: custom, normal, xml, csv, table You can also use one of the output search commands:
http://www.splunk.com/base/Documentation/3.4.9/User/UnsupportedSearchCommands#outputcsv
http://www.splunk.com/base/Documentation/3.4.9/User/UnsupportedSearchCommands#outputraw
and the other outputtxt outputxml

Or the export option from the GUI or CLI: http://www.splunk.com/base/Documentation/3.4.9/Admin/ExportEventData

[barakreeves]

Here is the updated syntax and related doco link:
/splunk search "index=_* audit" -output 'csv' > /var/share/splunk_output/20140724-audit.csv

doco link: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/CLIsearchsyntax

[jameshfisher]

Doesn't work. WARN: The following arguments were unknown or had no effect: 'format'